hxxps://github[.]com/tututu-patch/saicrack/blob/main/saicrack[.]exe

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/tututu-patch/saicrack/blob/main/saicrack.exe

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2140	saicrack.exe
4176	saicrack.exe

Loads dropped DLL 1 IoCs

pid	Process
4176	saicrack.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 371037.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
2836	msedge.exe
2836	msedge.exe
2584	identity_helper.exe
2584	identity_helper.exe
384	msedge.exe
384	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4984	2836	msedge.exe	44
PID 2836 wrote to memory of 4984	2836	msedge.exe	44
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4140	2836	msedge.exe	87
PID 2836 wrote to memory of 4208	2836	msedge.exe	89
PID 2836 wrote to memory of 4208	2836	msedge.exe	89
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88
PID 2836 wrote to memory of 1968	2836	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/tututu-patch/saicrack/blob/main/saicrack.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f4d746f8,0x7ff8f4d74708,0x7ff8f4d74718
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Users\Admin\Downloads\saicrack.exe
  "C:\Users\Admin\Downloads\saicrack.exe"
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Users\Admin\Downloads\saicrack.exe
    "C:\Users\Admin\Downloads\saicrack.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,11049588891089392455,17108045443919066645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
176494dff74d7334008d85200e6c929e

SHA1
3ce4d53d6c9087c95ce4a5bb171c080529e0a955

SHA256
56c9b5815606f420f2b8bcba1362ce246d109fa6615f4b558ff8b596efb6f137

SHA512
465b30dda158d106b57a39d40d90c967c4986ff481d05f053d466a2f919e91af3788d22dc2ff420fb77dff6bc8d7d29c5d97107a16bf1906c2d5a00338f8ced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
454e7cd4fbb0751ffa354ec86870a258

SHA1
716d6739a2a278446c3e9c16cb72d996d042bc89

SHA256
9cbad050449dd86a473ca97a90c4b4f6076f3174f52ae515de52cb4793f3d5ca

SHA512
83e6e36c576ef32a555d6a6e3ed9fe4ad51d7681bbfcc6421c29b15cadb0bcc918e4a9d6388ca0e1a1ca750830164ef64ca8015d07a0a2b8ec81fb17c5bc6f87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12d7c04994e3a5a7b78fe71f3d402253

SHA1
ac8146a48674de30e445c55e5683a5330ac8c0d7

SHA256
461e68408615f0fefb7709620be5937577f292079683dab6df231c202365b007

SHA512
f2a365309f729b6df1fbc9043392610f3b621eb040e51eec372deba94a3f5b4c63054cd4d1645d66eda00f553c6b947bdd1cf01c89bf1962c328c402a22eae50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e34c471420871f3e071936213672462d

SHA1
9f37c415dec2d97f05dd8f5e10a8da9d27618e17

SHA256
aad9273031eaf3214e3bb4e62d2a5e7766b7a02efebb5521cbf258c60c1475ca

SHA512
ae834ec3de57dc4f9f38632db0441d0d28664d7d15637126e7d644951e3df5694eb03973a0533c1deaf48e1f67a02a0906b4c2dbd36bbe4a9b005a3cdbd50f7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09663ff7acc83b85b8421accf4bf2749

SHA1
a7af1a28969d0c982eaee11bd9fb7bac9eacafb7

SHA256
a60a7587a71987e93d5f06f1957edf2ab307986388897d0254c6c43e0eec9544

SHA512
7f18d01229a2415f7b40ee8f5ea75bc89af93c9bdc3203139826b91faad4ddb7d8b5f4c64be0e9c85341543f9d6d3c278915cc26f11dbff16d300a6265fa9e96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9bcc0f8ea0a276995b3980edb29b262

SHA1
4fcb8958df9232cc0bc44c8399ea727717eade6b

SHA256
170a87f67c94cc4a611de7c177e35503ed05fbae4b1823f2c3fdaab4bb5c54db

SHA512
5100d99b138e52e133bb96781dba9683422d430087c14c20207fe1f456477836827d2b303ba5861bb86e6b5ea4513b5889847a0bd1df8bffa5a999b364c15620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5870b6.TMP

Filesize
874B

MD5
67559a84f18a292666ef84b10e19e6fd

SHA1
c6b6e6f24b87344d48f96d392906d7b2be49bd4c

SHA256
082c73ed66466ce64ac801367e05738066de762aac75d5c07cf8fe8199524ea5

SHA512
a7b12a404bc9d25afc3faed3fc0206554847c0e2c0e4efe7dd33aa32a4afef8ab5dd765e89a9ef0971da7e10e1acba7ddfbef3224d80811b4e031b84118d82b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2c22c60998cd8744523c826cd9947074

SHA1
e90f0a73d5dbd46547dccdb90a953622b83b8236

SHA256
07e5cd0fd1c4fb637b9bbc7ae540ce529f5a5fb62eaded87b27a82e84459f074

SHA512
932029192104c129ff46349a463eff466380c72f45ba7adea33fec94b79bb30cb1afa21d0fa066befd71d46ce31d4254a5c1cae71042677d8380a446061c4892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
fc45fb37c289eca0bded0a5c9868a66f

SHA1
bca4f5192d04bfc2b0f62fedaccc1663a614bc0f

SHA256
6f1ffb55f4e82bdc19e7b1d87844e5b08746e3a38fa49c78d266ee2f43dab87e

SHA512
62d2e098b3eb09b36e9ee951e0fdd11ea05a81d3955e056fe5e3fd5354a3f6cb7e2c7516e05f19540ceea66f898275cab7e905e7e5f32820f2ce92b309fa20e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21402\python27.dll

Filesize
2.3MB

MD5
0689bf814812dd1f04d9e62e69b28123

SHA1
8a2644ec1db354c13b58c4ce32e8e651e4d7c056

SHA256
4bf70e90594a6d3fbc042747bb314f541e84c0d5f7ec1cf82beac0afd94b5348

SHA512
ebc44c42682917557947f1c20e95094790c29d9ccf466fde4f744d5b4bad0d5e8d0c7f43a3d11217567111ef2aa039960e7db669e6ff87f07baa4469b9060aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21402\python27.dll

Filesize
2.3MB

MD5
0689bf814812dd1f04d9e62e69b28123

SHA1
8a2644ec1db354c13b58c4ce32e8e651e4d7c056

SHA256
4bf70e90594a6d3fbc042747bb314f541e84c0d5f7ec1cf82beac0afd94b5348

SHA512
ebc44c42682917557947f1c20e95094790c29d9ccf466fde4f744d5b4bad0d5e8d0c7f43a3d11217567111ef2aa039960e7db669e6ff87f07baa4469b9060aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21402\saicrack.exe.manifest

Filesize
475B

MD5
8b486cc5b709a0a48b61731a6a560729

SHA1
4d9348db41e2a733c1aef006a15c7e28db2f86bb

SHA256
10a5fc4b8862ce450f1f94eb1e10ba3b92a3d250a5d75943e9e69b3fbc54ef51

SHA512
63132fb958d56f05b4e862894947aec33a13592e40ad4be3a4b64a0a5bafe872bd95913dcc4efa99462a6dc08a78b9fbf04a716470e5d772e3e726ac8c55e26b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 371037.crdownload

Filesize
2.7MB

MD5
977b525935c4815a57d0fa1da785ca3c

SHA1
4f5791487b63a02a63d956ade1b22c0a70aaa21a

SHA256
7eee0207ac1683aa09ffbcd7156b60bf7a4a2ff8e9784da08c1132a71bc7ce7a

SHA512
a42919085db4c937dbec5b1bc05a7422d01a437d5708c0228c07d2aef7ba12887d7028c9961ae4d5e28a6ecb5698a70ae4e1ffc140408ec6cb92d67e5a3d6eae

Download Submit
C:\Users\Admin\Downloads\saicrack.exe

Filesize
2.7MB

MD5
977b525935c4815a57d0fa1da785ca3c

SHA1
4f5791487b63a02a63d956ade1b22c0a70aaa21a

SHA256
7eee0207ac1683aa09ffbcd7156b60bf7a4a2ff8e9784da08c1132a71bc7ce7a

SHA512
a42919085db4c937dbec5b1bc05a7422d01a437d5708c0228c07d2aef7ba12887d7028c9961ae4d5e28a6ecb5698a70ae4e1ffc140408ec6cb92d67e5a3d6eae

Download Submit
C:\Users\Admin\Downloads\saicrack.exe

Filesize
2.7MB

MD5
977b525935c4815a57d0fa1da785ca3c

SHA1
4f5791487b63a02a63d956ade1b22c0a70aaa21a

SHA256
7eee0207ac1683aa09ffbcd7156b60bf7a4a2ff8e9784da08c1132a71bc7ce7a

SHA512
a42919085db4c937dbec5b1bc05a7422d01a437d5708c0228c07d2aef7ba12887d7028c9961ae4d5e28a6ecb5698a70ae4e1ffc140408ec6cb92d67e5a3d6eae

Download Submit
C:\Users\Admin\Downloads\saicrack.exe

Filesize
2.7MB

MD5
977b525935c4815a57d0fa1da785ca3c

SHA1
4f5791487b63a02a63d956ade1b22c0a70aaa21a

SHA256
7eee0207ac1683aa09ffbcd7156b60bf7a4a2ff8e9784da08c1132a71bc7ce7a

SHA512
a42919085db4c937dbec5b1bc05a7422d01a437d5708c0228c07d2aef7ba12887d7028c9961ae4d5e28a6ecb5698a70ae4e1ffc140408ec6cb92d67e5a3d6eae

Download Submit